📍Join Office Hours with CyberCX — Bring your toughest GRC challenge and see it solved live
MarketplaceCybersecurityBaseline Cyber Security Controls for Small and Medium Organizations
CybersecurityGuideline

Baseline Cyber Security Controls for Small and Medium Organizations

The Baseline Cyber Security Controls for Small and Medium Organizations provides guidance from the Canadian Centre for Cyber Security to improve the resilience of smaller organizations through focused cybersecurity measures. It applies the 80/20 rule, aiming to achieve significant cybersecurity benefits with minimal effort.

Book your strategy callView source ↗

Overview

This guidance document offers a set of recommended cybersecurity practices tailored for small and medium organizations in Canada, defined as having fewer than 500 employees. It addresses common cybersecurity threats, such as cybercrime, and presents an actionable list of controls aimed at mitigating these risks, including incident response planning, automatic patching, secure configurations, and employee awareness training. The document emphasizes cost-effective measures and acknowledges the practical limitations faced by smaller entities. It also provides insights into organizational controls, baseline controls, and threat levels specific to this sector. This publication is part of Canada's broader effort to improve national cybersecurity resilience.

Related in Cybersecurity

CybersecurityControl setGuideline

ITSG-33 — IT Security Risk Management: A Lifecycle Approach (ITSG-33)

ITSG-33 is a guideline developed by the Canadian Centre for Cyber Security to help government departments manage IT security risks effectively. It outlines activities at both departmental and project levels, providing a structured process for integrating security considerations into IT environments and maintaining authorization to operate.

Canadian Centre for Cyber Security • Canada

View details
CybersecurityStandard

ESMA Minimum Standard IT Security Controls

The ESMA Minimum Standard IT Security Controls is a cybersecurity and compliance framework that defines the minimum security requirements service providers must implement to protect ESMA systems, applications, data, and information services.

European Securities and Markets Authority (ESMA) • EU

View details
CybersecurityStandardFramework

DISP 2020 — Defence Industry Security Program (DISP)– Suitability Assessment (2020)

The Defence Industry Security Program (DISP) is an Australian Defence membership program that helps organizations implement and demonstrate appropriate security controls for participating in Defence projects and managing Defence-related information and assets.

Australian Department of Defence • Australia • v2020

View details
CybersecurityStandardFramework

DISP 2022 — Defence Industry Security Program – Suitability Requirements (2022)

The Defence Industry Security Program (DISP) is an Australian Defence security assurance program that helps organizations meet security requirements for Defence contracts and projects by implementing appropriate governance, personnel, physical, and information security controls.

Australian Government • Australia • v2022

View details

Ready to manage these frameworks?

6clicks maps regulations to controls, evidence and risks — automatically.

Book your strategy call